How to use the evaluate operator with the app or workspace scope function in Azure Log Analytics?

1
votes

I've been looking at the evaluate operator when doing queries using Azure Log Analytics, in particular with the autocluster plugin (but I seem to have the same problem even with preview and diffpatterns).

If I have a query accessing the resource directly (including all tables or just one) it works fine. But if I do the same query across several apps or workspaces. I get an error message:

One or more pattern references were not declared. Detected pattern references: Support

The use of app() or workspace() scope function seems to be the problem- not doing a union to query across several resources.

This doesn't work:

workspace("vmPROD").Perf
| evaluate autocluster()

Neither does this:

app("someService").traces
| evaluate autocluster()

This works:

Perf
| evaluate autocluster()

The problem is that I want to evaluate across resources. At first I thought it might be a scope function limitation, but table() - also a scope function, works.

This works:

table("Perf")
| evaluate autocluster()

How can i work around this limitation? Is this a bug? There is nothing in the documentation that mentions this limitation.

1
azureazure-log-analytics

1 Answers

0
votes

After trying different ways to solve this I came across the materialize() function. This function allows you to cache the result of a subquery, and it seems like I can use the machine learning functions against the cached result when using app() or workspace() to reference the resource. This also works when doing joins- which is what I wanted to do across resources. There are two main limitations to think about, you can at most cache a 5GB result, and you have to use the let operator.

Here is an example with a join:

let joinResult = union app('Konstrukt.SL.CalculationEngine').requests,app('Konstrukt.SL.AggregationEngine').requests;
let cachedJoinResult = materialize(joinResult);
cachedJoinResult 
| where success == false
| project session_Id, user_Id, appName,operation_Id,itemCount 
| evaluate autocluster();